It is generally appreciated that enterprise computing infrastructures are too large and complex to be managed efficiently by humans alone. Increasingly IT managers are using management software, such as the suite of Hewlett-Packard OpenView software, to help manage such computing environments.
Such management software may be used, for example, to help IT managers diagnose problems and assess the impact of change or failure of components in the computing environment.
However, in order for such management software to be effective it is generally necessary to have an accurate representation or model of the computing environment in a suitable form.
Enterprise computing environments are typically highly complex in nature involving large numbers of computing devices of different kinds ranging from desktop computers, servers, routers, and the like. The computing devices are typically connected to one or more networks, and each computing device may have a different set of applications installed or executing thereon. Applications may also be distributed across one or more computing devices leading to complex inter-dependencies between both computing devices and software applications.
Enterprise computer environments are also typically highly dynamic with software frequently being installed, modified, updated, removed, etc. However, often IT managers are not informed when changes to the computing environment are made making it difficult for an overall representation of the computing environment to be maintained, and without an accurate model managing the computing environment becomes difficult. Furthermore, manually maintaining a configuration management database in such environments is unviable.
There are numerous automated techniques that may be deployed to build up and maintain a representation, such as a model, of a computing environment. Although manual methods may be used it is typically impractical to do so due to the large size, complexity and dynamic nature of all but the simplest computing environments.
Commonly used techniques include probing, agents and packet capture.
Probing involves attempting to identify the presence of a specific software application on a host computer by attempting to contact a host computing device on a reserved or well known port and by comparing any response received with a list of known responses. However, probing itself can only be used to identify the presence of known elements of an application, such as a HTTP server, a telnet server and the like.
Packet capture involves ‘sniffing’ data packets, typically at the Internet protocol (IP) layer, by software or hardware elements that capture packets in a network. The captured packets are analysed to try and determine to which host computing device and software application they relate. However, such techniques are typically unable to identify anything more than IP address and port number end points and thus do not directly enable an application to be identified. This is especially the case when packet encryption is used as the contents of the packets are encrypted.
Software agents are applications that are installed on a host computing device and used to query the operating system of the computing device to determine information about the applications that are active on host computing device. The information gathered, which for example may include Internet protocol (IP) addresses, process identifiers, network ports in use, etc. for each application may then be reported to a centralised repository. Once the gathered information has been obtained analysis of the information may be performed to attempt to identify at least some software applications in the network.
However, current analysis techniques are somewhat unsophisticated and rely generally on basic pattern matching techniques to match known combinations of process ID, IP address, port number, etc., obtained from known applications to those discovered in a computing infrastructure.
Accordingly, one aim of the present invention is to overcome, or at least to alleviate, at least some of the above-mentioned problems.